Vulnerabilities
Xinference Path Traversal Allows Unauthenticated File Deletion on Windows
Attackers can overwrite or delete JSON configuration files in Xinference 4.0.1 and earlier by injecting backslash sequences into model registration requests.
Vulnerabilities
Vulnerabilities
WP Strong Testimonials Object Injection Flaw in Versions Through 3.3.12
The National Vulnerability Database rates CVE-2026-107436 as a high severity issue that allows object injection via untrusted data deserialization.
Vulnerabilities
phpMyFAQ WebAuthn Bypass Allows Unauthenticated Account Takeover
A critical flaw in phpMyFAQ lets attackers register passkeys for any user, bypassing passwords and TOTP to seize control of accounts.
Vulnerabilities
User Registration Plugin CVE-2026-92798: Unauthenticated Shortcode Execution via HTTP_REFERER
Unauthenticated attackers can trigger arbitrary shortcode execution via the HTTP_REFERER header in affected versions of the User Registration & Membership plugin.
Vulnerabilities
Claude Agent SDK Python CLI Injection Bypasses Permission Controls
Unvalidated resume tokens in the Python SDK allow attackers to inject CLI flags, executing arbitrary commands outside security boundaries in versions before 0.2.121.
Vulnerabilities
libiec61850 Buffer Overread Causes Remote Server Crash in IEC 61850 Stacks
A high-severity flaw in libiec61850 allows remote attackers to crash servers via malformed dataset requests, with a fix available in version 1.6.2.
Vulnerabilities
Go markdown library slice panic causes crash with Safelink flag
A bounds check error in the gomarkdown package allows attackers to crash services rendering untrusted input with very short link destinations.
Vulnerabilities
TuxGuitar .tg File Processing Allows Remote Code Execution
Opening a crafted guitar tablature file in TuxGuitar versions before 2.1.0 triggers Java class loading that executes arbitrary code with application privileges.
Vulnerabilities
XWorm C2 Panel Path Traversal Enables Unauthenticated Remote Code Execution
Researchers found that the XWorm RAT control panel allows attackers to overwrite system files and run code without logging in, using data found in infected clients.
Vulnerabilities
dcm4chee-arc-light Storage API Flaw Enables Silent Data Deletion
A critical vulnerability in J4Care's medical imaging archive allows attackers to delete files from storage while keeping database records intact, risking data loss.
Vulnerabilities
Bank of America Addresses AI-Discovered Vulnerabilities and AML Fine
Bank of America spends hundreds of millions on remediation after receiving an early release of Anthropic's Claude Mythos Preview tool.
Vulnerabilities
MONST3R-AI Uses Compromised AI Keys for Autonomous Scans, Shifting Costs
Criminals sell a scanner that runs on compromised OpenAI, Anthropic and Google keys, forcing victims to pay for the compute costs of attacks on third parties.
Vulnerabilities
OpenNextJS Cloudflare Cache Bypass in Middleware Matching Allows Auth Evasion
A high-severity flaw in OpenNextJS Cloudflare lets attackers bypass middleware authorization by exploiting inconsistent path decoding in cached routes.
Vulnerabilities
X.Org Server XKB Heap Buffer Overflow Flaw Allows Privilege Escalation
A heap-based buffer overflow in the XkbChangeKeycodeRange function of X.Org Server enables local privilege escalation to root access.
Vulnerabilities
X.Org Server Heap Overflow in Glamor Module Fixes CVE-2026-93522 Root Access Flaw
A flaw in the X.Org Server glamor module allows local attackers to gain root access via a heap-based buffer overflow, with a vendor patch now available.
Vulnerabilities
ServiceNext 1.00 IDOR Flaw Exposes User Profiles and Cleartext Passwords
An insecure direct object reference in ServiceNext SerTec 1.00 allows authenticated users to access any account, including unencrypted credentials.
Vulnerabilities
InvoiceShelf Token Bypass Allows Cross-Document Data Exposure Before v2.4.0
A high-severity flaw in InvoiceShelf lets attackers use expired or mismatched tokens to view private invoices and estimates from other companies.
Vulnerabilities
External Attack Surface Scanning Best Practices
External attack surface scanning reveals hidden digital assets that internal audits miss, exposing the true scope of your organization's exposure to remote threats.
Vulnerabilities
7 Apache Struts Mistakes That Leave Your Server Open to Attack
Misconfigured parsers and outdated libraries allow attackers to execute arbitrary code on your server without needing valid credentials.
Vulnerabilities
Zero-Click Exploits: How Silent Attacks Bypass Your Defenses
Zero-click exploits compromise devices without user interaction, making traditional security warnings and training ineffective against silent data theft.
Vulnerabilities
Vert.x PostgreSQL Client Pre-Auth DoS via Unbounded Memory in CVE-2026-103223
A high-severity vulnerability in the Vert.x PostgreSQL client allows attackers to crash applications via crafted message headers before authentication completes.
Vulnerabilities
Rancher Project Name Collision Enables Cross-Cluster Privilege Escalation
A flaw in Rancher allows users to create projects with duplicate names across clusters, granting unauthorized access to resources in separate environments.
Vulnerabilities
Vulnerability Exception Handling: Rules for Safe Risk Acceptance
Treating exceptions as permanent fixes creates hidden debt. Proper exception handling requires strict time limits, active monitoring, and compensating controls to keep risk within bounds.
Vulnerabilities
Eclipse Vert.x gRPC: Compressed Messages Bypass Size Limits, Risk Memory Exhaustion
A flaw in Eclipse Vert.x allows attackers to bypass size limits via compressed gRPC messages, risking memory exhaustion in affected server versions.